What Is a Zero-Day Exploit?

A zero-day exploit is a special form of exploit, i.e. the exploitation of a vulnerability where no patch exists yet for a discovered security hole. Such an exploit can be used for very dangerous, because undetected, zero-day attacks that spread, for example, rootkits, remote access Trojans (RATs), or other malware.

What is a zero-day exploit?

The zero-day exploit takes advantage of previously undetected vulnerabilities or programming errors in software or programs. On the part of the manufacturer, no patch or correction exists yet for the exploit to close the vulnerability, as the bug is not yet known.

A zero-day exploit can be detected at the earliest after an initial attack on a system. However, zero-day attacks often go unnoticed for a long time.

The attacker using a zero-day exploit has a head start on vendors and users that can be exploited to cause major damage or manipulate a large number of systems without being noticed. A zero-day exploit occurs because the person or organization that found the vulnerability does not report it to the vendor, but instead develops code that exploits the vulnerability.

In some cases, the discoverers of the vulnerability sell their findings and leave the development of a malicious code to the buyers. Zero-day exploits can be used to spread viruses, Trojans, worms, rootkits, and other types of malicious code, for example.

What makes a zero-day exploit so dangerous?

The danger of the zero-day exploit lies in the lack of knowledge of the vulnerability. Hackers thus get a head start on exploiting the vulnerability. Often, their activities go completely unnoticed for a long time. If the vulnerability becomes known, there is no solution to prevent the attack.

Even antivirus software is unable to respond effectively to a zero-day exploit. Software manufacturers must first take action to develop a suitable patch. For the longest possible use of the zero-day exploit, hackers keep it secret. A race is created between attackers and software manufacturers, in which the attacker has a time advantage thanks to the zero-day exploit.

The sequence of a zero-day attack

When an attacker exploits a zero-day exploit, it is known as a zero-day attack. The attack begins as soon as the exploit is actively deployed. Often, the exploit can be used to inject malware into the attacked system. If the attack remains undetected, further systems can be manipulated via the zero-day exploit. Even if the attack is discovered, no effective protection exists yet.

Only when the developers deliver a patch to close the security hole can the attack be effectively defended against. From that point on, it is no longer a zero-day exploit. Even if a patch has been released, the exploit can still cause damage for extended periods of time because not all systems will receive the fix in a timely manner.

The market for zero-day exploits

A separate market exists for zero-day exploits, where different prices are paid for the exploits depending on the type of vulnerability and the number of potentially affected systems. Hackers trade zero-day exploits in their own circles, but also offer them to software manufacturers or government institutions (intelligence services). This is because both government and private sector organizations have some interest in zero-day exploits.

Intelligence agencies and the military try to use zero-day exploits to prepare for a cyberwar or to actively use the exploit themselves for their own attacks and espionage. Software companies can secure their products by purchasing a zero-day exploit before they are attacked and the company’s reputation is damaged.

How can you protect against zero-day exploits?

Since the vulnerability that the zero-day exploit exploits are unknown, it is very difficult to effectively protect potentially compromised systems. However, some preventive measures can be taken to minimize the risk of a zero-day attack. For example, data transmission on networks should be secured and encrypted.

Installed intrusion detection systems (IDS) and intrusion prevention systems (IPS) provide additional protection by reacting to unusual communication patterns and informing administrators or taking defensive measures on their own. Since potentially any software is a gateway for zero-day attacks, users should keep the number of programs on their systems as small as possible. Unnecessary software should be removed from the system. It is also important to ensure that all programs and operating systems are up to date.